CVE-2026-93908 describes a stored XSS vulnerability in the Real Estate Manager – Property Listing and Agent Management WordPress plugin. The flaw exists in the 'before_price_text' parameter, which is insufficiently sanitized and escaped, allowing authenticated attackers with subscriber-level privileges or higher to inject arbitrary JavaScript. The vulnerability is exacerbated by the absence of capability checks, nonce verification, or ownership validation in the wp_ajax_rem_create_pro_ajax handler. Additionally, because the injected data is stored via update_post_meta rather than post_content, WordPress's wp_kses filtering tied to the unfiltered_html capability does not apply, enabling persistent script injection.

An attacker with subscriber-level or higher access can inject malicious scripts that execute in the context of other users viewing the affected pages, potentially leading to session hijacking, privilege escalation, or other malicious actions. The vulnerability does not require user interaction (no UI needed) and affects confidentiality and integrity but not availability. There are no known exploits in the wild at this time.

No patch or official fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level users from untrusted sources and monitor for suspicious activity related to the 'before_price_text' parameter. Avoid granting unnecessary privileges to users and consider disabling or limiting the use of the vulnerable AJAX handler if possible.